diff --git a/.gitignore b/.gitignore
index 42cc560..e821930 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 /jdk-jdk12-jdk-12+33.tar.xz
 /systemtap_3.2_tapsets_hg-icedtea8-9d464368e06d.tar.xz
 /jdk-updates-jdk12u-jdk-12.0.1+12.tar.xz
+/jdk-updates-jdk12u-jdk-12.0.2+9.tar.xz
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 34a8e5d..094cefd 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -206,7 +206,7 @@
 
 # New Version-String scheme-style defines
 %global majorver 12
-%global securityver 1
+%global securityver 2
 # buildjdkver is usually same as %%{majorver},
 # but in time of bootstrap of next jdk, it is majorver-1, 
 # and this it is better to change it here, on single place
@@ -224,7 +224,7 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{origin}
 %global minorver        0
-%global buildver        12
+%global buildver        9
 # priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
 %global priority %( printf '%02d%02d%02d%02d' %{majorver} %{minorver} %{securityver} %{buildver} )
@@ -950,7 +950,7 @@ Version: %{newjavaver}.%{buildver}
 # This package needs `.rolling` as part of Release so as to not conflict on install with
 # java-X-openjdk. I.e. when latest rolling release is also an LTS release packaged as
 # java-X-openjdk. See: https://bugzilla.redhat.com/show_bug.cgi?id=1647298
-Release: 2.rolling%{?dist}
+Release: 1.rolling%{?dist}
 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons
 # and this change was brought into RHEL-4. java-1.5.0-ibm packages
 # also included the epoch in their virtual provides. This created a
@@ -1824,6 +1824,9 @@ require "copy_jdk_configs.lua"
 
 
 %changelog
+* Thu Jul 18 2019 Severin Gehwolf <sgehwolf@redhat.com> - 1:12.0.2.9-1.rolling
+- Update to July 2019 CPU update (tag jdk-12.0.2+9)
+
 * Tue May 21 2019 Petra Alice Mikova <pmikova@redhat.com> - 1:12.0.1.12-2.rolling
 - fixed requires/provides for the non-system JDK case (backport of RHBZ#1702324)
 
diff --git a/sources b/sources
index f10eec3..20e442e 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (jdk-updates-jdk12u-jdk-12.0.1+12.tar.xz) = 356164791873b9ddbbac0eb6281ab4e542b97556f4f5a8748edc93ececf1fcb661aaa9955080b693bfc697dc75be8297acb080c4e1a2e579ca8a8741d0ab1881
+SHA512 (jdk-updates-jdk12u-jdk-12.0.2+9.tar.xz) = ed1b5dec108fb29f72a8a80faca22703d3d1378d5a3b535c9e41b8f73d51d6650dd72e0e4b2e79de61c9f85013b26f39f6a7b5292b646bd6f5b3a54c9922fbf9
 SHA512 (systemtap_3.2_tapsets_hg-icedtea8-9d464368e06d.tar.xz) = cf578221b77d8c7e019f69909bc86c419c5fb5e10bceba9592ff6e7f96887b0a7f07c9cefe90800975247a078785ca190fdec5c2d0f841bb447cee784b570f7d
diff --git a/update_package.sh b/update_package.sh
index 51cb6de..4058d02 100644
--- a/update_package.sh
+++ b/update_package.sh
@@ -31,11 +31,10 @@ else
   echo ${TAPSET}
 fi
 
-# OpenJDK from Shenandoah project
-export PROJECT_NAME="jdk"
-export REPO_NAME="jdk12"
-# warning, clonning without shenadnaoh suffix, you will clone pure jdk - thus without shenandaoh GC
-export VERSION="jdk-12+25"
+# OpenJDK from jdk-updates/jdk12u
+export PROJECT_NAME="jdk-updates"
+export REPO_NAME="jdk12u"
+export VERSION="jdk-12.0.2+9"
 export COMPRESSION=xz
 # unset tapsets overrides
 export OPENJDK_URL=""